Read the docs
TI-2025-09518 Aliases CVE-2025-10385GHSA-q5pj-h5w4-7f24

Mercury KM08-708H GiGA WiFi Wave2 mcr_setSysAdm sub_450B2C buffer overflow

Priority HIGH 71CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

A vulnerability has been found in Mercury KM08-708H GiGA WiFi Wave2 1.1. Affected by this issue is the function sub_450B2C of the file /goform/mcr_setSysAdm. The manipulation of the argument ChgUserId leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0447 91st percentileScored 2026-11-08
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MercuryKM08-708H GiGA WiFi Wave21.1—No fix listedCNA
  • KM08-708H GiGA WiFi Wave2 VendorMercury Affected 1.1 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-10385
  2. 2026-10-03 Alias added: GHSA-q5pj-h5w4-7f24
  3. 2026-10-04 EPSS moved to the 90th–95th percentile

References

Exploit 1

  • TI-2020-14386 A remote command execution vulnerability exists in add_server_service of PPTP_SERVER in… CVSS 3.1CRITICAL 9.8
  • TI-2025-09525 Mercury KM08-708H GiGA WiFi Wave2 HTTP Header stack-based overflow CVSS 4.0CRITICAL 9.3
  • TI-2024-08029 Mercury MNVR816 web-static file access CVSS 4.0MEDIUM 6.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences